# CVEs published 2026-08-26

394 CVEs were published on August 26, 2026: 81 critical, 171 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-47874](https://cve.now/CVE-2026-47874.md): Reactor Netty HTTP Server Denial of Service With Pipelined Requests (CVSS 5.3, Spring Reactor Netty)
- [CVE-2026-47861](https://cve.now/CVE-2026-47861.md): UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false (CVSS 6.3, Spring Integration)
- [CVE-2026-81421](https://cve.now/CVE-2026-81421.md): ddfourtwo sentry-selfhosted-mcp raw\_sentry\_api server-side request forgery (CVSS 6.9, ddfourtwo sentry-selfhosted-mcp)
- [CVE-2026-47863](https://cve.now/CVE-2026-47863.md): Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush (CVSS 5.9, Spring Reactor Core)
- [CVE-2026-47862](https://cve.now/CVE-2026-47862.md): ZipTransformer uses file\_name header to build workDirectory path without sanitization (CVSS 5.4, Spring Integration)
- [CVE-2026-47860](https://cve.now/CVE-2026-47860.md): Unbounded decompression of attacker-supplied compressed message bodies (CVSS 6.5, Spring AMQP)
- [CVE-2026-47859](https://cve.now/CVE-2026-47859.md): Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS (CVSS 5.4, Spring Integration)
- [CVE-2026-47857](https://cve.now/CVE-2026-47857.md): Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around (CVSS 5.9, Spring Reactor Core)
- [CVE-2026-47856](https://cve.now/CVE-2026-47856.md): JsonToObjectTransformer resolves the json\_\_TypeId\_\_ message header to an arbitrary class without an allow-list (CVSS 6.3, Spring Integration)
- [CVE-2026-47852](https://cve.now/CVE-2026-47852.md): Predictable cache directory location allows local ONNX model substitution in Spring AI (CVSS 7.5, Spring AI)
- [CVE-2026-47851](https://cve.now/CVE-2026-47851.md): Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader (CVSS 7.5, Spring AI)
- [CVE-2026-47850](https://cve.now/CVE-2026-47850.md): Spring Data REST allows mutation of the version property of immutable aggregates via PUT (CVSS 4.3, Spring Data REST)
- [CVE-2026-47845](https://cve.now/CVE-2026-47845.md): Reactor Netty HTTP Server may incorrectly evaluate proxy addresses (CVSS 5.3, Spring Reactor Netty)
- [CVE-2026-80183](https://cve.now/CVE-2026-80183.md): In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment (CVSS 7.1, OpenStack Keystone)
- [CVE-2026-47665](https://cve.now/CVE-2026-47665.md): Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML (CVSS 8.7, penpot)
- [CVE-2026-47666](https://cve.now/CVE-2026-47666.md): Penpot: Stored XSS via custom font family name injected into a @font-face style rule (CVSS 7.6, penpot)
- [CVE-2026-65956](https://cve.now/CVE-2026-65956.md): KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF (CVSS 10.0, 1Panel-dev KubePi)
- [CVE-2026-81203](https://cve.now/CVE-2026-81203.md): SourceCodester Simple Online Food Ordering System ajax.php login2 sql injection (CVSS 6.9, SourceCodester Simple Online Food Ordering System)
- [CVE-2025-62341](https://cve.now/CVE-2025-62341.md): HCL Connections is vulnerable to server-side request forgery (SSRF) (CVSS 3.7, HCLSoftware Connections)
- [CVE-2026-80158](https://cve.now/CVE-2026-80158.md): Ansible-collection-community-general: community.general: ipa\_getkeytab does not set no\_log on the bind\_pw parameter, disclosing the ipa bind password in logs and process listings (CVSS 5.5, Red Hat Ceph Storage · Red Hat OpenStack Platform)
- [CVE-2026-69129](https://cve.now/CVE-2026-69129.md): KubePi: Insufficient per-cluster authorization checks in cluster management APIs (CVSS 5.8, 1Panel-dev KubePi)
- [CVE-2026-21808](https://cve.now/CVE-2026-21808.md): HCL BigFix Quantum Risk Analyzer is affected by logging sensitive information (CVSS 4.1, HCLSoftware BigFix Quantum Risk Analyzer)
- [CVE-2026-21807](https://cve.now/CVE-2026-21807.md): HCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflow (CVSS 3.9, HCLSoftware BigFix Quantum Risk Analyzer)
- [CVE-2026-61617](https://cve.now/CVE-2026-61617.md): Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion (CVSS 7.7, pterodactyl wings)
- [CVE-2026-21810](https://cve.now/CVE-2026-21810.md): HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking (CVSS 4.4, HCLSoftware BigFix Quantum Risk Analyzer)
- [CVE-2026-55182](https://cve.now/CVE-2026-55182.md): LibreNMS: Remote Code Execution by Signal Alert Transportation Module (CVSS 8.6, librenms · librenms/librenms)
- [CVE-2026-63360](https://cve.now/CVE-2026-63360.md): LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint (CVSS 7.4, LimeSurvey)
- [CVE-2026-45694](https://cve.now/CVE-2026-45694.md): LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters (CVSS 5.4, librenms · librenms/librenms)
- [CVE-2026-16809](https://cve.now/CVE-2026-16809.md): LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering (CVSS 7.2, LimeSurvey)
- [CVE-2026-77611](https://cve.now/CVE-2026-77611.md): SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename (CVSS 7.1, seaweedfs)
- [CVE-2026-81202](https://cve.now/CVE-2026-81202.md): itsourcecode Payroll System CRUD Operation ajax.php delete missing authentication (CVSS 6.9, itsourcecode Payroll System)
- [CVE-2026-43621](https://cve.now/CVE-2026-43621.md): Simple Machines Forum \< 2.1.7 Authorization Confusion via Profile::load() (CVSS 8.6, SimpleMachines SMF)
- [CVE-2026-77317](https://cve.now/CVE-2026-77317.md): SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite (CVSS 8.1, seaweedfs)
- [CVE-2026-65930](https://cve.now/CVE-2026-65930.md): LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields (CVSS 4.8, LimeSurvey)
- [CVE-2026-64632](https://cve.now/CVE-2026-64632.md): A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account. (CVSS 8.5, Veeam ONE)
- [CVE-2026-65646](https://cve.now/CVE-2026-65646.md): Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose ar (CVSS 9.9, WebPros Plesk)
- [CVE-2026-65642](https://cve.now/CVE-2026-65642.md): Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and (CVSS 8.6, WebPros Plesk)
- [CVE-2026-58070](https://cve.now/CVE-2026-58070.md): A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to (CVSS 6.8, Veeam Backup and Replication)
- [CVE-2026-65647](https://cve.now/CVE-2026-65647.md): Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root. (CVSS 8.7, WebPros Plesk Migrator · WebPros Plesk Site Import)
- [CVE-2026-65641](https://cve.now/CVE-2026-65641.md): A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account. (CVSS 9.3, Veeam One)
- [CVE-2026-77298](https://cve.now/CVE-2026-77298.md): SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy (CVSS 8.7, seaweedfs)
- [CVE-2026-77368](https://cve.now/CVE-2026-77368.md): SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths (CVSS 7.6, seaweedfs)
- [CVE-2026-21809](https://cve.now/CVE-2026-21809.md): HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information (CVSS 3.9, HCLSoftware BigFix Quantum Risk Analyzer)
- [CVE-2026-77573](https://cve.now/CVE-2026-77573.md): Weblate: DNS rebinding in VCS operations allows server-side request forgery (CVSS 3.5, WeblateOrg weblate)
- [CVE-2026-77507](https://cve.now/CVE-2026-77507.md): Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users (CVSS 5.3, WeblateOrg weblate)
- [CVE-2026-15973](https://cve.now/CVE-2026-15973.md): LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries (CVSS 8.4, LimeSurvey)
- [CVE-2026-62326](https://cve.now/CVE-2026-62326.md): Weblate Has Uncontrolled Resource Consumption via (CVSS 6.5, WeblateOrg weblate)
- [CVE-2026-62249](https://cve.now/CVE-2026-62249.md): Weblate: Restricted-component change history leaked to non-member project users through the nested \`GET /api/projects/{slug}/changes/\` endpoint (CVSS 4.3, WeblateOrg weblate)
- [CVE-2026-61792](https://cve.now/CVE-2026-61792.md): Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242) (CVSS 7.7, WeblateOrg weblate)
- [CVE-2026-79921](https://cve.now/CVE-2026-79921.md): amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload (CVSS 8.9, rabbitmq amqp091-go · github.com/rabbitmq/amqp091-go)
- [CVE-2026-61790](https://cve.now/CVE-2026-61790.md): Weblate: Team-enforced 2FA is bypassed for global permissions (CVSS 4.4, WeblateOrg weblate)
- [CVE-2026-55228](https://cve.now/CVE-2026-55228.md): Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project (CVSS 8.1, WeblateOrg weblate · weblate)
- [CVE-2026-55227](https://cve.now/CVE-2026-55227.md): Observable object existence disclosure in private Weblate projects via globally scoped object lookups (CVSS 4.3, WeblateOrg weblate · weblate)
- [CVE-2026-71054](https://cve.now/CVE-2026-71054.md): Vulnerability in Oracle Java SE (component: 2D). (CVSS 6.5, Oracle Java SE)
- [CVE-2026-77508](https://cve.now/CVE-2026-77508.md): Weblate: Unverified REST API email changes (CVSS 3.5, WeblateOrg weblate)
- [CVE-2026-75601](https://cve.now/CVE-2026-75601.md): Static Web Server: Authentication bypass on /metrics endpoint when --basic-auth is enabled (CVSS 4.3, static-web-server)
- [CVE-2026-60004](https://cve.now/CVE-2026-60004.md): Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. (CVSS 9.8, KEV, Gitea · code.gitea.io/gitea +1)
- [CVE-2026-79938](https://cve.now/CVE-2026-79938.md): Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. (CVSS 7.6, Dell Power Protect Cyber Recovery · Dell Cyber Recovery)
- [CVE-2026-79939](https://cve.now/CVE-2026-79939.md): Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability. (CVSS 5.8, Dell Power Protect Cyber Recovery · Dell Cyber Recovery)
- [CVE-2026-46369](https://cve.now/CVE-2026-46369.md): Nimiq: Validity store off by one error (CVSS 7.5, nimiq core-rs-albatross · nimiq-blockchain)
- [CVE-2026-66003](https://cve.now/CVE-2026-66003.md): Frappe: Access control bypass via REST API dot-notation fields on linked doctypes (CVSS 7.1, frappe)
- [CVE-2026-49809](https://cve.now/CVE-2026-49809.md): Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('S (CVSS 6.5, Dell Power Protect Cyber Recovery · Dell Cyber Recovery)
- [CVE-2026-47848](https://cve.now/CVE-2026-47848.md): Reactor Netty WebSocket Client Leaks Credentials On Redirect (CVSS 6.1, Spring Reactor Netty)
- [CVE-2026-47844](https://cve.now/CVE-2026-47844.md): Reactor Netty HTTP Server Leaks Exception Details (CVSS 5.3, Spring Reactor Netty)
- [CVE-2026-47843](https://cve.now/CVE-2026-47843.md): Reactor Netty may incorrectly route traffic due to DNS resolver reuse (CVSS 3.7, Spring Reactor Netty)
- [CVE-2026-47842](https://cve.now/CVE-2026-47842.md): Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation (CVSS 6.5, Spring Security)
- [CVE-2026-47834](https://cve.now/CVE-2026-47834.md): Spring Data JPA Sort expression validation bypass (CVSS 4.8, Spring Data JPA)
- [CVE-2026-77652](https://cve.now/CVE-2026-77652.md): Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index (CVSS 7.8, GNOME Dia)
- [CVE-2026-74770](https://cve.now/CVE-2026-74770.md): Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Comman (CVSS 8.8, Dell PowerProtect One)
- [CVE-2026-54245](https://cve.now/CVE-2026-54245.md): Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database (CVSS 7.6, fleetdm fleet · github.com/fleetdm/fleet/v4 +1)
- [CVE-2026-74771](https://cve.now/CVE-2026-74771.md): Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability. (CVSS 6.5, Dell PowerProtect One)
- [CVE-2026-46371](https://cve.now/CVE-2026-46371.md): Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint (CVSS 6.5, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-74774](https://cve.now/CVE-2026-74774.md): Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. (CVSS 5.9, Dell PowerProtect One)
- [CVE-2026-67275](https://cve.now/CVE-2026-67275.md): Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. (CVSS 5.3, Dell PowerProtect One)
- [CVE-2026-56547](https://cve.now/CVE-2026-56547.md): An input reflection vulnerability affects HCL Traveler (CVSS 3.5, HCLSoftware Traveler)
- [CVE-2026-46370](https://cve.now/CVE-2026-46370.md): Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint (CVSS 6.5, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-68861](https://cve.now/CVE-2026-68861.md): Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Comman (CVSS 8.8, Dell PowerProtect One)
- [CVE-2026-68863](https://cve.now/CVE-2026-68863.md): Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability. (CVSS 7.5, Dell PowerProtect One)
- [CVE-2026-71172](https://cve.now/CVE-2026-71172.md): Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. (CVSS 4.3, Dell Cloud Disaster Recovery)
- [CVE-2026-41262](https://cve.now/CVE-2026-41262.md): Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint (CVSS 4.3, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-71171](https://cve.now/CVE-2026-71171.md): Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Com (CVSS 7.2, Dell Cloud Disaster Recovery)
- [CVE-2026-48786](https://cve.now/CVE-2026-48786.md): Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint (CVSS 6.5, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2026-70419](https://cve.now/CVE-2026-70419.md): Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Com (CVSS 9.1, Dell Cloud Disaster Recovery)
- [CVE-2026-79940](https://cve.now/CVE-2026-79940.md): Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. (CVSS 5.9, Dell iDRAC9)
- [CVE-2026-63179](https://cve.now/CVE-2026-63179.md): Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets (CVSS 4.9, wintercms winter · winter/wn-backend-module)
- [CVE-2026-19485](https://cve.now/CVE-2026-19485.md): Bucket Squatting in Vertex AI Search for Commerce (CVSS 9.3, Google Cloud Vertex AI Search for Commerce)
- [CVE-2026-54256](https://cve.now/CVE-2026-54256.md): Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata (CVSS 5.4, wintercms winter · winter/wn-backend-module)
- [CVE-2026-32639](https://cve.now/CVE-2026-32639.md): Winter: Broken access control in \`Cms\\Controllers\\Index\` allows cross-template actions and unauthorized asset uploads (CVSS 6.8, wintercms winter · winter/wn-cms-module)
- [CVE-2026-58474](https://cve.now/CVE-2026-58474.md): whichllm \< 0.5.16 Code Injection via run and snippet commands (CVSS 8.6, Andyyyy64 whichllm)
- [CVE-2026-76784](https://cve.now/CVE-2026-76784.md): Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home Devices (CVSS 8.7, TP-Link Systems HS103P3 / HS103P4 · TP-Link Systems EP10 +18)
- [CVE-2026-32593](https://cve.now/CVE-2026-32593.md): Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax (CVSS 5.9, wintercms winter · winter/wn-backend-module)
- [CVE-2026-47841](https://cve.now/CVE-2026-47841.md): WebAuthn User Verification Bypass via Session Serialization (CVSS 7.4, Spring Security)
- [CVE-2026-47837](https://cve.now/CVE-2026-47837.md): Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests (CVSS 6.8, Spring Cloud Config)
- [CVE-2026-47836](https://cve.now/CVE-2026-47836.md): Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN (CVSS 7.2, Spring Cloud Config)
- [CVE-2026-32258](https://cve.now/CVE-2026-32258.md): Winter: Stored XSS through Editor Settings custom styles (CVSS 8.1, wintercms winter · winter/wn-backend-module)
- [CVE-2026-32257](https://cve.now/CVE-2026-32257.md): Winter: Stored XSS through Brand Settings custom styles (CVSS 8.1, wintercms winter · winter/wn-backend-module)
- [CVE-2026-35445](https://cve.now/CVE-2026-35445.md): Winter: Authenticated backend users can bypass Users controller permission checks (CVSS 7.1, wintercms winter · winter/wn-backend-module)
- [CVE-2026-81036](https://cve.now/CVE-2026-81036.md): Stalwart Mail Server through 0.16.19 Authorization Code Disclosure via Unvalidated OAuth redirect\_uri (CVSS 8.5, stalwartlabs stalwart)
- [CVE-2026-81035](https://cve.now/CVE-2026-81035.md): Midday Missing Owner Check on Team Deletion (CVSS 7.2, midday-ai midday)
- [CVE-2026-81034](https://cve.now/CVE-2026-81034.md): Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client (CVSS 8.3, gravitl netmaker)
- [CVE-2026-81033](https://cve.now/CVE-2026-81033.md): Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy (CVSS 6.9, automatisch)
- [CVE-2026-81032](https://cve.now/CVE-2026-81032.md): NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration (CVSS 9.3, vesoft-inc nebula)
- [CVE-2026-81031](https://cve.now/CVE-2026-81031.md): IDURAR ERP CRM through 4.1.1 Account Takeover via Unverified Identifier on Password Update (CVSS 8.6, idurar-erp-crm)
- [CVE-2026-81030](https://cve.now/CVE-2026-81030.md): Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser\_items Endpoint (CVSS 7.1, mage-ai)
- [CVE-2026-81029](https://cve.now/CVE-2026-81029.md): OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI (CVSS 8.5, open-metadata OpenMetadata)
- [CVE-2026-81028](https://cve.now/CVE-2026-81028.md): ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision (CVSS 6.9, ZLMediaKit)
- [CVE-2026-81027](https://cve.now/CVE-2026-81027.md): one-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning (CVSS 8.4, songquanpeng one-api)
- [CVE-2026-80428](https://cve.now/CVE-2026-80428.md): ILIAS PHP Object Injection via Shibboleth Logout (CVSS 9.3, ILIAS-eLearning e.V. ILIAS)
- [CVE-2026-80427](https://cve.now/CVE-2026-80427.md): bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter (CVSS 8.6, nfriedly bestzip)
- [CVE-2026-80426](https://cve.now/CVE-2026-80426.md): FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description (CVSS 7.0, voxel51 fiftyone)
- [CVE-2026-48549](https://cve.now/CVE-2026-48549.md): Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie (CVSS 6.9, Nagios Enterprises, LLC. Nagios Core · Nagios Enterprises,…)
- [CVE-2026-48548](https://cve.now/CVE-2026-48548.md): Nagios Core CSRF via cmd.cgi (CVSS 6.9, Nagios Enterprises, LLC. Nagios Core)
- [CVE-2026-54614](https://cve.now/CVE-2026-54614.md): DebugKit: MailPreview contains unsafe reflection (CVSS 4.3, cakephp debug\_kit · cakephp/debug\_kit)
- [CVE-2026-54569](https://cve.now/CVE-2026-54569.md): SENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core (CVSS 9.8, senaite.core · senaite-core)
- [CVE-2026-54606](https://cve.now/CVE-2026-54606.md): SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed (CVSS 8.5, JiHong88 suneditor · suneditor)
- [CVE-2026-75062](https://cve.now/CVE-2026-75062.md): Eval Injection in google/langfun via default lf.query protocol (CVSS 9.2, Google langfun)
- [CVE-2026-80589](https://cve.now/CVE-2026-80589.md): block: stop the timeout timer when releasing a never added disk (CVSS 9.8, Linux)
- [CVE-2026-80588](https://cve.now/CVE-2026-80588.md): mptcp: reclaim forward-allocated memory on RX path errors (CVSS 7.5, Linux)
- [CVE-2026-80587](https://cve.now/CVE-2026-80587.md): mptcp: avoid combining some incoming suboptions (CVSS 9.8, Linux)
- [CVE-2026-80586](https://cve.now/CVE-2026-80586.md): mptcp: options: reset DSS fields in case of unexpected size (CVSS 9.8, Linux)
- [CVE-2026-80585](https://cve.now/CVE-2026-80585.md): mptcp: fastopen: only mark MPTFO subflows with SYN data (CVSS 9.4, Linux)
- [CVE-2026-80584](https://cve.now/CVE-2026-80584.md): s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVSS 8.4, Linux)
- [CVE-2026-80583](https://cve.now/CVE-2026-80583.md): ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses (CVSS 7.8, Linux)
- [CVE-2026-80582](https://cve.now/CVE-2026-80582.md): drm/shmem\_helper: Check VMA boundaries for PMD mappings (CVSS 7.8, Linux)
- [CVE-2026-80581](https://cve.now/CVE-2026-80581.md): ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout (no CVSS, Linux)
- [CVE-2026-80580](https://cve.now/CVE-2026-80580.md): fbdev: bound mode sysfs output to the sysfs buffer (CVSS 7.8, Linux)
- [CVE-2026-80579](https://cve.now/CVE-2026-80579.md): fbdev: clear fb\_info-\>mode before deleting a videomode (CVSS 7.8, Linux)
- [CVE-2026-80578](https://cve.now/CVE-2026-80578.md): fbdev: core: Fix pointer desynchronization in fb\_io\_read() (CVSS 7.3, Linux)
- [CVE-2026-80577](https://cve.now/CVE-2026-80577.md): drm/panthor: skip zero-sized firmware sections (no CVSS, Linux)
- [CVE-2026-80576](https://cve.now/CVE-2026-80576.md): drm/amdgpu: reject oversized IBs with per-ring packet limits (CVSS 8.8, Linux)
- [CVE-2026-80575](https://cve.now/CVE-2026-80575.md): Input: cs40l50-vibra - validate custom data from user space (CVSS 7.8, Linux)
- [CVE-2026-80574](https://cve.now/CVE-2026-80574.md): Input: focaltech - fix array out-of-bounds in focaltech\_process\_rel\_packet (CVSS 8.4, Linux)
- [CVE-2026-80573](https://cve.now/CVE-2026-80573.md): Input: iforce - validate input packet lengths (no CVSS, Linux)
- [CVE-2026-80572](https://cve.now/CVE-2026-80572.md): Input: byd - synchronize timer deletion before freeing private data (CVSS 7.8, Linux)
- [CVE-2026-80571](https://cve.now/CVE-2026-80571.md): powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (no CVSS, Linux)
- [CVE-2026-80570](https://cve.now/CVE-2026-80570.md): Input: synaptics-rmi4 - zero report size on F54 work error (CVSS 7.8, Linux)
- [CVE-2026-80569](https://cve.now/CVE-2026-80569.md): Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (CVSS 7.8, Linux)
- [CVE-2026-80568](https://cve.now/CVE-2026-80568.md): Input: synaptics-rmi4 - block s\_input when F54 queue is busy (CVSS 7.8, Linux)
- [CVE-2026-80567](https://cve.now/CVE-2026-80567.md): Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (no CVSS, Linux)
- [CVE-2026-80566](https://cve.now/CVE-2026-80566.md): Input: hynitron\_cstxxx - validate touch count and finger IDs (no CVSS, Linux)
- [CVE-2026-80565](https://cve.now/CVE-2026-80565.md): crypto: qce - fix error path in devm\_qce\_register\_algs (CVSS 7.8, Linux)
- [CVE-2026-80564](https://cve.now/CVE-2026-80564.md): gve: fix NULL dereference due to missing ptp adjfine (no CVSS, Linux)
- [CVE-2026-80563](https://cve.now/CVE-2026-80563.md): gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (no CVSS, Linux)
- [CVE-2026-80562](https://cve.now/CVE-2026-80562.md): gpio: ml-ioh: use raw\_spinlock\_t for the register lock (no CVSS, Linux)
- [CVE-2026-80561](https://cve.now/CVE-2026-80561.md): libceph: fix multiple unsafe decodes in decode\_locker() (CVSS 9.8, Linux)
- [CVE-2026-80560](https://cve.now/CVE-2026-80560.md): openrisc: signal: do not restore privileged SR bits on sigreturn (CVSS 7.8, Linux)
- [CVE-2026-80559](https://cve.now/CVE-2026-80559.md): Input: sur40 - fix input device registration ordering (CVSS 7.8, Linux)
- [CVE-2026-80558](https://cve.now/CVE-2026-80558.md): libceph: Avoid using invalid osd indices from primary\_temp (CVSS 9.8, Linux)
- [CVE-2026-80557](https://cve.now/CVE-2026-80557.md): libceph: fix OOB read in decode\_watchers() via missing bounds check (CVSS 9.8, Linux)
- [CVE-2026-80556](https://cve.now/CVE-2026-80556.md): mmc: atmel-mci: Fix use-after-free in atmci\_remove due to race condition (CVSS 7.8, Linux)
- [CVE-2026-80555](https://cve.now/CVE-2026-80555.md): s390/vfio\_ccw: Free all memory if cp\_init() fails (CVSS 7.1, Linux)
- [CVE-2026-80554](https://cve.now/CVE-2026-80554.md): s390/vfio\_ccw: Limit the number of channel program segments (CVSS 9.3, Linux)
- [CVE-2026-80553](https://cve.now/CVE-2026-80553.md): s390/vfio\_ccw: Cancel existing workqueues (CVSS 8.8, Linux)
- [CVE-2026-80552](https://cve.now/CVE-2026-80552.md): s390/vfio\_ccw: Ensure index for read/write regions are within range (CVSS 8.8, Linux)
- [CVE-2026-80551](https://cve.now/CVE-2026-80551.md): s390/vfio\_ccw: Ensure first IDAW remains constant (CVSS 9.3, Linux)
- [CVE-2026-80550](https://cve.now/CVE-2026-80550.md): s390/vfio\_ccw: Fix out of bounds check on CCW array (CVSS 7.9, Linux)
- [CVE-2026-80549](https://cve.now/CVE-2026-80549.md): s390/vfio\_ccw: Move cp cleanup out of not operational (CVSS 8.2, Linux)
- [CVE-2026-80548](https://cve.now/CVE-2026-80548.md): s390/vfio\_ccw: Selectively expand io\_mutex (CVSS 8.8, Linux)
- [CVE-2026-80547](https://cve.now/CVE-2026-80547.md): s390/vfio\_ccw: Implement a crw lock (CVSS 8.8, Linux)
- [CVE-2026-80546](https://cve.now/CVE-2026-80546.md): s390/zcrypt: Improve CCA CPRB length and overflow checks (CVSS 7.8, Linux)
- [CVE-2026-80545](https://cve.now/CVE-2026-80545.md): s390/zcrypt: Improve EP11 CPRB length and overflow checks (CVSS 7.8, Linux)
- [CVE-2026-80544](https://cve.now/CVE-2026-80544.md): s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing (CVSS 7.8, Linux)
- [CVE-2026-80543](https://cve.now/CVE-2026-80543.md): s390/zcrypt: Pad trailing CCA or EP11 message with zeros (no CVSS, Linux)
- [CVE-2026-80542](https://cve.now/CVE-2026-80542.md): drm/amd/display: Fix NULL pointer dereference in amdgpu\_dm\_crtc\_set\_vblank() (no CVSS, Linux)
- [CVE-2026-80541](https://cve.now/CVE-2026-80541.md): drm/amdgpu: validate GEM\_CREATE domain combinations (CVSS 7.8, Linux)
- [CVE-2026-80540](https://cve.now/CVE-2026-80540.md): drm/amdgpu: Fix UVD decode image min size calculation (CVSS 7.8, Linux)
- [CVE-2026-80539](https://cve.now/CVE-2026-80539.md): drm/amdgpu: disallow multiple FENCE chunks in one submit (no CVSS, Linux)
- [CVE-2026-80538](https://cve.now/CVE-2026-80538.md): xfs: propagate errors from xfs\_rtginode\_load (CVSS 7.1, Linux)
- [CVE-2026-80537](https://cve.now/CVE-2026-80537.md): xfs: fix off-by-one in rtrefcount btree root level validation (CVSS 7.8, Linux)
- [CVE-2026-80536](https://cve.now/CVE-2026-80536.md): xfs: bounds-check buffer log item's dirty bitmap (CVSS 8.4, Linux)
- [CVE-2026-80535](https://cve.now/CVE-2026-80535.md): xfs: don't double-lock when deleting a self-referential directory (no CVSS, Linux)
- [CVE-2026-80534](https://cve.now/CVE-2026-80534.md): xfs: fix ilock leak on error in xfs\_dq\_get\_next\_id (no CVSS, Linux)
- [CVE-2026-80533](https://cve.now/CVE-2026-80533.md): xfs: don't walk off the end of a null sc-\>sa.agi\_bp in AGI repair (no CVSS, Linux)
- [CVE-2026-80532](https://cve.now/CVE-2026-80532.md): xfs: fix another iunlink infinite loop bug in online fsck (no CVSS, Linux)
- [CVE-2026-80531](https://cve.now/CVE-2026-80531.md): xfs: avoid UAF on sc-\>tempip in xrep\_tempfile\_create (CVSS 7.8, Linux)
- [CVE-2026-80530](https://cve.now/CVE-2026-80530.md): xfs: fix exchange-range reflink flag clearing issue with INO1\_WRITTEN (CVSS 7.1, Linux)
- [CVE-2026-80529](https://cve.now/CVE-2026-80529.md): xfs: don't swallow dquot recovery verification errors (no CVSS, Linux)
- [CVE-2026-80528](https://cve.now/CVE-2026-80528.md): ceph: avoid fs reclaim while using current-\>journal\_info (CVSS 9.8, Linux)
- [CVE-2026-80527](https://cve.now/CVE-2026-80527.md): ceph: fix hanging \_\_ceph\_get\_caps() with stale mds\_wanted (CVSS 7.5, Linux)
- [CVE-2026-80526](https://cve.now/CVE-2026-80526.md): ASoC: tas2562: Validate values for volume writes (CVSS 7.8, Linux)
- [CVE-2026-80525](https://cve.now/CVE-2026-80525.md): ASoC: SOF: ipc4-topology: Refresh copier IPC payload before widget setup (no CVSS, Linux)
- [CVE-2026-80524](https://cve.now/CVE-2026-80524.md): optee: ffa: Add NULL check in optee\_ffa\_lend\_protmem (no CVSS, Linux)
- [CVE-2026-80523](https://cve.now/CVE-2026-80523.md): clk: spacemit: k3: set hdma clock as critical (CVSS 7.1, Linux)
- [CVE-2026-80522](https://cve.now/CVE-2026-80522.md): crypto: tegra - fix rctx-\>cryptlen calculation in tegra\_gcm\_do\_one\_req() (CVSS 7.8, Linux)
- [CVE-2026-80521](https://cve.now/CVE-2026-80521.md): af\_unix: Unlink scc\_entry in unix\_del\_edge(). (CVSS 7.8, Linux)
- [CVE-2026-80520](https://cve.now/CVE-2026-80520.md): ovpn: fix NULL dereference when killing missing key (CVSS 7.5, Linux)
- [CVE-2026-80519](https://cve.now/CVE-2026-80519.md): ovpn: finish crypto callback cleanup before peer release (CVSS 9.8, Linux)
- [CVE-2026-74754](https://cve.now/CVE-2026-74754.md): scsi: core: pair EH runtime PM get and put (no CVSS, Linux)
- [CVE-2026-74753](https://cve.now/CVE-2026-74753.md): perf: Reject exited events as group leaders (CVSS 7.8, Linux)
- [CVE-2026-74752](https://cve.now/CVE-2026-74752.md): sctp: validate cookie AUTH state before use (CVSS 9.8, Linux)
- [CVE-2026-74751](https://cve.now/CVE-2026-74751.md): riscv: lib: Fix ZBB strnlen reading past count boundary (CVSS 9.4, Linux)
- [CVE-2026-74750](https://cve.now/CVE-2026-74750.md): ovpn: defer key slot crypto freeing to workqueue (CVSS 7.5, Linux)
- [CVE-2026-74749](https://cve.now/CVE-2026-74749.md): rseq: Prevent hard lockup on granted time slice extension (no CVSS, Linux)
- [CVE-2026-74748](https://cve.now/CVE-2026-74748.md): netfilter: ipset: fix refcount race between list:set GC and swap (CVSS 7.8, Linux)
- [CVE-2026-74747](https://cve.now/CVE-2026-74747.md): ipvs: revalidate ihl to prevent out-of-bounds access (CVSS 7.8, Linux)
- [CVE-2026-74746](https://cve.now/CVE-2026-74746.md): netfilter: flowtable: publish GC-visible tuple last (CVSS 9.8, Linux)
- [CVE-2026-74745](https://cve.now/CVE-2026-74745.md): eth: bnxt: avoid deadlock when canceling IRQ affinity notifier (CVSS 7.5, Linux)
- [CVE-2026-74744](https://cve.now/CVE-2026-74744.md): ipvlan: inherit needed\_headroom and needed\_tailroom from phy\_dev (CVSS 9.8, Linux)
- [CVE-2026-74743](https://cve.now/CVE-2026-74743.md): macvlan: inherit needed\_headroom and needed\_tailroom from lowerdev (CVSS 9.8, Linux)
- [CVE-2026-74742](https://cve.now/CVE-2026-74742.md): veth: fix queue index used to wake the peer txq in veth\_poll (CVSS 7.5, Linux)
- [CVE-2026-74741](https://cve.now/CVE-2026-74741.md): net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling (CVSS 7.5, Linux)
- [CVE-2026-74740](https://cve.now/CVE-2026-74740.md): net/sched: act\_api: fix TOCTOU NULL deref on a-\>goto\_chain (no CVSS, Linux)
- [CVE-2026-74739](https://cve.now/CVE-2026-74739.md): net/sched: cls\_u32: skip hash tables in u32\_bind\_class() (CVSS 7.8, Linux)
- [CVE-2026-74738](https://cve.now/CVE-2026-74738.md): regmap: sdw-mbq: don't call an unset readable\_reg callback (no CVSS, Linux)
- [CVE-2026-74737](https://cve.now/CVE-2026-74737.md): net: ethernet: ti: am65-cpsw-nuss: Fix port\_id extraction from SRC TAG (CVSS 9.8, Linux)
- [CVE-2026-74736](https://cve.now/CVE-2026-74736.md): net/sched: cls\_bpf: reject dev-bound programs bound to a different device (CVSS 7.8, Linux)
- [CVE-2026-74735](https://cve.now/CVE-2026-74735.md): l2tp: fix tunnel and session refcount leak on seq\_file release (no CVSS, Linux)
- [CVE-2026-74734](https://cve.now/CVE-2026-74734.md): firewire: ohci: fix NULL pointer dereference in ar\_context\_release (no CVSS, Linux)
- [CVE-2026-54511](https://cve.now/CVE-2026-54511.md): @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys (CVSS 8.6, dahlia logtape · @logtape/syslog)
- [CVE-2026-54550](https://cve.now/CVE-2026-54550.md): IzPack: Path Traversal in UnpackerBase allows writing files outside the installation directory via malicious pack entries (CVSS 7.4, izpack · org.codehaus.izpack:izpack-installer)
- [CVE-2026-54523](https://cve.now/CVE-2026-54523.md): Kyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any… (CVSS 9.6, kyverno · github.com/kyverno/kyverno)
- [CVE-2026-54548](https://cve.now/CVE-2026-54548.md): kas: Persistent SSH Host Key Checking Disablement (CVSS 3.3, siemens kas · kas)
- [CVE-2026-54553](https://cve.now/CVE-2026-54553.md): Starlette-Admin: Unvalidated \`order\_by\` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS (CVSS 5.4, jowilf starlette-admin · starlette-admin)
- [CVE-2026-54556](https://cve.now/CVE-2026-54556.md): Http4s: HTTP/2 Denial of Service with Ember Backend (CVSS 8.2, http4s · org.http4s http4s-ember-core\_2.12 +5)
- [CVE-2026-13481](https://cve.now/CVE-2026-13481.md): Out-of-bounds read in PTP management TLV TIME parsing in Zephyr net PTP (CVSS 5.4, zephyrproject zephyr)
- [CVE-2026-13480](https://cve.now/CVE-2026-13480.md): Out-of-bounds read in LoRaWAN fragmented data block transport (FUOTA) downlink handler (CVSS 3.1, zephyrproject zephyr)
- [CVE-2026-13479](https://cve.now/CVE-2026-13479.md): Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink handler (CVSS 3.1, zephyrproject zephyr)
- [CVE-2026-19271](https://cve.now/CVE-2026-19271.md): Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk (CVSS 7.5, TÜBİTAK BİLGEM Software Technologies Research Institute Lid…)
- [CVE-2025-10903](https://cve.now/CVE-2025-10903.md): Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-3035](https://cve.now/CVE-2026-3035.md): Authentication Bypass Using an Alternate Path or Channel in GitLab (CVSS 5.5, GitLab)
- [CVE-2026-7487](https://cve.now/CVE-2026-7487.md): Access Control Check Implemented After Asset is Accessed in GitLab (CVSS 3.5, GitLab)
- [CVE-2026-15387](https://cve.now/CVE-2026-15387.md): Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab (CVSS 4.3, GitLab)
- [CVE-2026-18252](https://cve.now/CVE-2026-18252.md): Inclusion of Functionality from Untrusted Control Sphere in GitLab (CVSS 7.3, GitLab)
- [CVE-2026-77801](https://cve.now/CVE-2026-77801.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2026-75896](https://cve.now/CVE-2026-75896.md): Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk (CVSS 9.1, TÜBİTAK BİLGEM Software Technologies Research Institute Lid…)
- [CVE-2026-79902](https://cve.now/CVE-2026-79902.md): Gimp: stack vla size underflow denial of service in seattle (CVSS 5.5, GNOME GIMP · Red Hat Enterprise Linux)
- [CVE-2026-15990](https://cve.now/CVE-2026-15990.md): Formidable Charts \<= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm\_graph' Parameter (CVSS 7.5, Strategy11 Formidable Charts)
- [CVE-2026-75960](https://cve.now/CVE-2026-75960.md): Insufficiently Protected Credentials in Rently Smart Home (CVSS 8.7, Rently Smart Home)
- [CVE-2026-73108](https://cve.now/CVE-2026-73108.md): RustDesk \< 1.4.7 Uncontrolled Memory Allocation DoS via BytesCodec (CVSS 8.7, rustdesk)
- [CVE-2026-73102](https://cve.now/CVE-2026-73102.md): RustDesk Path Traversal via macOS Clipboard File-Paste (CVSS 6.9, rustdesk)
- [CVE-2026-12717](https://cve.now/CVE-2026-12717.md): Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection (CVSS 9.4, Google Cloud BigQuery Data Transfer Service)
- [CVE-2026-79619](https://cve.now/CVE-2026-79619.md): OpenZFS: user-namespace capability check allows unprivileged local authorization bypass (CVSS 7.3, OpenZFS)
- [CVE-2026-12587](https://cve.now/CVE-2026-12587.md): Embedded credentials in Virtuagym (CVSS 8.6, Resamania Virtuagym)
- [CVE-2026-77658](https://cve.now/CVE-2026-77658.md): Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project files (CVSS 7.8, GNOME Dia)
- [CVE-2026-15985](https://cve.now/CVE-2026-15985.md): Classified Listing - Mobile Number Verification \<= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login (CVSS 8.1, RadiusTheme Classified Listing - Mobile Number Verification)
- [CVE-2026-63041](https://cve.now/CVE-2026-63041.md): Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers (CVSS 5.3, Apache Software Foundation Apache APISIX)
- [CVE-2026-18080](https://cve.now/CVE-2026-18080.md): ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce \<= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment (CVSS 9.8, wedevs ERP: Complete HR, Accounting & CRM Suite Built for W…)
- [CVE-2026-3235](https://cve.now/CVE-2026-3235.md): WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps \<= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access (CVSS 5.3, peterschulznl WP Data Access – App Builder for Tables, Form…)
- [CVE-2026-5092](https://cve.now/CVE-2026-5092.md): Greenshift \<= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI (CVSS 6.4, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2026-77532](https://cve.now/CVE-2026-77532.md): A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwi (CVSS 8.8, Ubiquiti EdgeMAX EdgeSwitch)
- [CVE-2026-77557](https://cve.now/CVE-2026-77557.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalat (CVSS 9.8, Ubiquiti UniFi Protect AI Key)
- [CVE-2026-77554](https://cve.now/CVE-2026-77554.md): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to exe (CVSS 10.0, Ubiquiti UniFi Talk Application)
- [CVE-2026-77553](https://cve.now/CVE-2026-77553.md): A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access (CVSS 9.9, Ubiquiti UniFi Access Application)
- [CVE-2026-77552](https://cve.now/CVE-2026-77552.md): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video (CVSS 9.8, Ubiquiti UniFi Enterprise Audio/Video Bridge)
- [CVE-2026-77551](https://cve.now/CVE-2026-77551.md): A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in Un (CVSS 9.0, Ubiquiti UniFi Connect Display Cast Pro)
- [CVE-2026-77550](https://cve.now/CVE-2026-77550.md): A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devic (CVSS 10.0, Ubiquiti UniFi OS Server · Ubiquiti Cloud Keys +11)
- [CVE-2026-77549](https://cve.now/CVE-2026-77549.md): A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnera (CVSS 9.0, Ubiquiti UniFi OS Server · Ubiquiti Cloud Keys +11)
- [CVE-2026-80206](https://cve.now/CVE-2026-80206.md): NLTK 3.10.2 Regular Expression Denial of Service via tgrep (CVSS 8.2, nltk)
- [CVE-2026-80205](https://cve.now/CVE-2026-80205.md): NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex (CVSS 8.7, nltk)
- [CVE-2026-80204](https://cve.now/CVE-2026-80204.md): Grav before 1.0.18 Authentication Bypass via Scoped API Key (CVSS 9.3, getgrav grav)
- [CVE-2026-80203](https://cve.now/CVE-2026-80203.md): Grav before 1.0.18 Authentication Bypass via Scoped API Key (CVSS 9.3, getgrav grav)
- [CVE-2026-77548](https://cve.now/CVE-2026-77548.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Prot (CVSS 9.9, Ubiquiti UniFi Protect Application)
- [CVE-2026-77547](https://cve.now/CVE-2026-77547.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Acce (CVSS 9.9, Ubiquiti UniFi Access Application)
- [CVE-2026-77546](https://cve.now/CVE-2026-77546.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Acce (CVSS 9.9, Ubiquiti UniFi Access Application)
- [CVE-2026-77545](https://cve.now/CVE-2026-77545.md): A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability f (CVSS 9.0, Ubiquiti UniFi OS Server · Ubiquiti Cloud Keys +11)
- [CVE-2026-80350](https://cve.now/CVE-2026-80350.md): OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL (CVSS 7.1, OneUptime)
- [CVE-2026-80349](https://cve.now/CVE-2026-80349.md): TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter (CVSS 9.3, TarsCloud TarsWeb)
- [CVE-2026-80348](https://cve.now/CVE-2026-80348.md): TarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete Endpoints (CVSS 8.7, TarsCloud TarsWeb)
- [CVE-2026-80347](https://cve.now/CVE-2026-80347.md): mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets (CVSS 8.7, kazuph mcp-fetch)
- [CVE-2026-80346](https://cve.now/CVE-2026-80346.md): StarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views (CVSS 7.1, StarRocks)
- [CVE-2026-77543](https://cve.now/CVE-2026-77543.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Acce (CVSS 9.9, Ubiquiti UniFi Access Application)
- [CVE-2026-77542](https://cve.now/CVE-2026-77542.md): A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UID Enter (CVSS 9.1, Ubiquiti UID Enterprise Agent)
- [CVE-2026-77541](https://cve.now/CVE-2026-77541.md): A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Netwo (CVSS 9.1, Ubiquiti UniFi Network Application)
- [CVE-2026-77540](https://cve.now/CVE-2026-77540.md): A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS (CVSS 9.1, Ubiquiti UniFi OS Server)
- [CVE-2026-77539](https://cve.now/CVE-2026-77539.md): A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS (CVSS 9.1, Ubiquiti UniFi OS Server)
- [CVE-2026-77538](https://cve.now/CVE-2026-77538.md): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to es (CVSS 8.2, Ubiquiti UniFi Connect Application)
- [CVE-2026-77537](https://cve.now/CVE-2026-77537.md): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to (CVSS 10.0, Ubiquiti UniFi Protect Application)
- [CVE-2026-77536](https://cve.now/CVE-2026-77536.md): A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devi (CVSS 9.9, Ubiquiti UniFi OS Server · Ubiquiti Cloud Keys +11)
- [CVE-2026-18794](https://cve.now/CVE-2026-18794.md): OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite (CVSS 8.8, CalcProgrammer1 OpenRGB)
- [CVE-2026-2388](https://cve.now/CVE-2026-2388.md): Reviews and Rating – Google Reviews \<= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4, designextreme Reviews and Rating – Google Reviews)
- [CVE-2026-77535](https://cve.now/CVE-2026-77535.md): A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Net (CVSS 9.1, Ubiquiti UniFi Network Application)
- [CVE-2026-59683](https://cve.now/CVE-2026-59683.md): OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings (CVSS 9.3, CalcProgrammer1 OpenRGB)
- [CVE-2026-77534](https://cve.now/CVE-2026-77534.md): A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devi (CVSS 9.9, Ubiquiti UniFi OS Server · Ubiquiti Cloud Keys +11)
- [CVE-2026-19042](https://cve.now/CVE-2026-19042.md): Command Injection in TeamViewer Desktop Client for Linux through Chat Link Handling (CVSS 8.8, TeamViewer Full Client · TeamViewer Host)
- [CVE-2026-59682](https://cve.now/CVE-2026-59682.md): Arbitrary file overwrite and deletion local and remote in OpenRGB (CVSS 8.8, CalcProgrammer1 OpenRGB)
- [CVE-2026-16444](https://cve.now/CVE-2026-16444.md): Improper Validation of File Paths in TeamViewer Desktop Clients (CVSS 7.5, TeamViewer Full Client, Host, QuickSupport & Portable · Tea…)
- [CVE-2026-77533](https://cve.now/CVE-2026-77533.md): A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Prot (CVSS 9.9, Ubiquiti UniFi Protect Application)
- [CVE-2026-19197](https://cve.now/CVE-2026-19197.md): Broken access control in dashboard snapshots (CVSS 6.3, Grafana OSS · Grafana Enterprise)
- [CVE-2026-19538](https://cve.now/CVE-2026-19538.md): Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS (CVSS 8.2, NLnet Labs NSD)
- [CVE-2026-19401](https://cve.now/CVE-2026-19401.md): Remote UDP DoS by sending multiple DNS Cookie options (CVSS 8.2, NLnet Labs NSD)
- [CVE-2026-18916](https://cve.now/CVE-2026-18916.md): Remote TCP DoS by throttling the TCP receive window (CVSS 6.9, NLnet Labs NSD)
- [CVE-2026-18664](https://cve.now/CVE-2026-18664.md): Wrong interpretation of ACL ranges (CVSS 8.2, NLnet Labs NSD)
- [CVE-2026-80237](https://cve.now/CVE-2026-80237.md): Thinking Software Technology｜Efence - Arbitrary File Upload (CVSS 8.8, Thinking Software Technology Efence)
- [CVE-2026-80236](https://cve.now/CVE-2026-80236.md): Thinking Software Technology｜Efence - SQL Injection (CVSS 8.2, Thinking Software Technology Efence)
- [CVE-2026-80235](https://cve.now/CVE-2026-80235.md): Thinking Software Technology｜EFence - Arbitrary File Upload (CVSS 9.8, Thinking Software Technology EFence)
- [CVE-2026-80234](https://cve.now/CVE-2026-80234.md): CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication (CVSS 5.3, CAYIN Technology CAYIN CMS-WS · CAYIN Technology CAYIN CMS-…)
- [CVE-2026-80233](https://cve.now/CVE-2026-80233.md): CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload (CVSS 7.2, CAYIN Technology CAYIN CMS-WS · CAYIN Technology CAYIN C… +1)
- [CVE-2026-9668](https://cve.now/CVE-2026-9668.md): SQL injection vulnerability in ZTE SCP product (CVSS 6.3, ZTE SCP)
- [CVE-2026-75977](https://cve.now/CVE-2026-75977.md): Mang Board WP \<= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie (CVSS 8.8, kitae-park Mang Board WP)
- [CVE-2026-6178](https://cve.now/CVE-2026-6178.md): Betheme \<= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon\_box\_2' Shortcode (CVSS 6.4, MuffinGroup Betheme)
- [CVE-2026-18884](https://cve.now/CVE-2026-18884.md): WooCommerce Lottery \<= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters (CVSS 7.5, wpgenie WooCommerce Lottery)
- [CVE-2026-78237](https://cve.now/CVE-2026-78237.md): Insufficient input validation in Admin By Request (ABR) (CVSS 7.8, Admin By Request)
- [CVE-2026-78236](https://cve.now/CVE-2026-78236.md): Insecure PIN derivation mechanism in Admin By Request (ABR) (CVSS 8.8, Admin By Request)
- [CVE-2026-58108](https://cve.now/CVE-2026-58108.md): Personal access token delete filters on Session columns while deleting from PersonalAccessTokenDB (CVSS 1.2, Ericsson CodeChecker)
- [CVE-2026-15366](https://cve.now/CVE-2026-15366.md): A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page (CVSS 2.4, vivo Kids Mode)
- [CVE-2026-15365](https://cve.now/CVE-2026-15365.md): A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app. (CVSS 2.4, vivo Kids Mode)
- [CVE-2026-18331](https://cve.now/CVE-2026-18331.md): Formidable Forms \<= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm\_user\_id' Parameter (CVSS 7.2, strategy11team Formidable Forms – WordPress Form Builder fo…)
- [CVE-2026-18431](https://cve.now/CVE-2026-18431.md): Avada \<= 7.16 and Fusion Builder \<= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write (CVSS 9.8, themefusion Avada (Fusion) Builder · ThemeFusion Avada | We…)
- [CVE-2026-3002](https://cve.now/CVE-2026-3002.md): Gutenverse \<= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks (CVSS 6.4, jegstudio Gutenverse – WordPress Blocks, Page Builder & Sit…)
- [CVE-2026-78146](https://cve.now/CVE-2026-78146.md): Noptin \< 4.3.3 - Unauthenticated Subscriber PII and confirm\_key Disclosure via Actions Page (CVSS 6.5, Simple Newsletter Plugin)
- [CVE-2026-77790](https://cve.now/CVE-2026-77790.md): RegistrationMagic \< 6.0.9.4 - Admin+ SQLi via 'rm\_sortby' Parameter (CVSS 5.5, RegistrationMagic)
- [CVE-2026-77789](https://cve.now/CVE-2026-77789.md): Stripe Payment Forms by WP Full Pay \< 8.5.1 - Cross-Customer Subscription Modification via IDOR (CVSS 4.3, Stripe Payment Forms by WP Full Pay)
- [CVE-2026-77758](https://cve.now/CVE-2026-77758.md): Stripe Payment Forms by WP Full Pay \< 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session (CVSS 5.3, Stripe Payment Forms by WP Full Pay)
- [CVE-2026-77757](https://cve.now/CVE-2026-77757.md): Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission (CVSS 5.4, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-77754](https://cve.now/CVE-2026-77754.md): Kirki \< 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki\_get\_apis (CVSS 5.3, Kirki)
- [CVE-2026-77695](https://cve.now/CVE-2026-77695.md): Woo Refund And Exchange Lite \< 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation (CVSS 6.5, Return Refund and Exchange For WooCommerce)
- [CVE-2026-77694](https://cve.now/CVE-2026-77694.md): Eventin \< 4.1.19 - Unauthenticated Order Completion Without Payment via order\_token (CVSS 5.3, Eventin)
- [CVE-2026-77693](https://cve.now/CVE-2026-77693.md): Order Tip for WooCommerce \< 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete\_exported\_csv\_file\_ajax (CVSS 8.7, Order Tip for WooCommerce)
- [CVE-2026-75798](https://cve.now/CVE-2026-75798.md): AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant (CVSS 5.3, AI Engine)
- [CVE-2026-75797](https://cve.now/CVE-2026-75797.md): AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter (CVSS 7.7, AI Engine)
- [CVE-2026-74930](https://cve.now/CVE-2026-74930.md): WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR (CVSS 4.3, Project Manager)
- [CVE-2026-74929](https://cve.now/CVE-2026-74929.md): WP Project Manager \< 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR (CVSS 5.4, Project Manager)
- [CVE-2026-74928](https://cve.now/CVE-2026-74928.md): WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes (CVSS 7.5, Project Manager)
- [CVE-2026-74851](https://cve.now/CVE-2026-74851.md): Pods \< 3.3.9.1 - Author+ RCE via Shortcode Display Callback (CVSS 7.2, Pods)
- [CVE-2026-19718](https://cve.now/CVE-2026-19718.md): BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery (CVSS 8.1, BlogVault Backup & Staging · MalCare WordPress Security… +1)
- [CVE-2026-19226](https://cve.now/CVE-2026-19226.md): Royal Elementor Addons \< 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings (CVSS 6.8, Royal Addons for Elementor)
- [CVE-2026-19220](https://cve.now/CVE-2026-19220.md): Forminator Forms \< 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation (CVSS 3.7, Forminator Forms)
- [CVE-2026-19094](https://cve.now/CVE-2026-19094.md): Tutor LMS \< 4.0.6 - Unauthenticated SQLi via 'offset' and 'item\_per\_page' Parameters (CVSS 5.3, Tutor LMS)
- [CVE-2026-16986](https://cve.now/CVE-2026-16986.md): Booking Package \< 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters (CVSS 5.3, Booking Package)
- [CVE-2026-16984](https://cve.now/CVE-2026-16984.md): WP Legal Pages \< 3.7.1 - Unauthenticated API Secret Disclosure (CVSS 6.5, Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, C…)
- [CVE-2026-14550](https://cve.now/CVE-2026-14550.md): WPCafe \< 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization (CVSS 5.3, WPCafe)
- [CVE-2026-14216](https://cve.now/CVE-2026-14216.md): Amelia \< 2.4.7 - Unauthenticated Notification Queue Dispatch (CVSS 6.5, Booking for Appointments and Events Calendar)
- [CVE-2026-14212](https://cve.now/CVE-2026-14212.md): Amelia Pro \< 9.8 - Provider+ Arbitrary Provider Password Update via IDOR (CVSS 4.7, Booking for Appointments and Events Calendar)
- [CVE-2026-13406](https://cve.now/CVE-2026-13406.md): Royal Elementor Addons \< 1.7.1066 - Unauthenticated Taxonomy Term Disclosure (CVSS 5.3, Royal Addons for Elementor)
- [CVE-2026-13404](https://cve.now/CVE-2026-13404.md): Royal Elementor Addons \< 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr\_likes\_init (CVSS 5.3, Royal Addons for Elementor)
- [CVE-2026-13172](https://cve.now/CVE-2026-13172.md): Eventin \< 4.1.22 - Unauthenticated Unpublished Content Disclosure (CVSS 5.3, Eventin)
- [CVE-2026-58094](https://cve.now/CVE-2026-58094.md): TOCTOU race in POSIX shared memory large page configuration (CVSS 7.8, FreeBSD)
- [CVE-2026-79654](https://cve.now/CVE-2026-79654.md): Ketello: katello content view history api cross-organization authorization bypass (CVSS 4.3, Red Hat Satellite 6.16 for RHEL · Red Hat Satellite 6.17… +3)
- [CVE-2026-15203](https://cve.now/CVE-2026-15203.md): Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software (CVSS 9.3, Danfoss iC7-Automation SP · Danfoss iC7-Marine +1)
- [CVE-2026-58093](https://cve.now/CVE-2026-58093.md): Kernel use-after-free via tty ioctls (CVSS 7.0, FreeBSD)
- [CVE-2026-19760](https://cve.now/CVE-2026-19760.md): WP Fastest Cache \<= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header (CVSS 7.2, emrevona WP Fastest Cache – WordPress Cache Plugin)
- [CVE-2026-58097](https://cve.now/CVE-2026-58097.md): ppp(8): missing length validation in mp\_SetEnddisc() (CVSS 7.8, FreeBSD)
- [CVE-2026-58096](https://cve.now/CVE-2026-58096.md): ppp(8): missing length validation in LcpDecodeConfig() (CVSS 8.8, FreeBSD)
- [CVE-2026-58095](https://cve.now/CVE-2026-58095.md): ppp(8): incorrect length calculation in mp\_Enddisc() (CVSS 8.8, FreeBSD)
- [CVE-2026-76149](https://cve.now/CVE-2026-76149.md): CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file. (CVSS 4.4, SASAKI Nobuyuki CorvusSKK)
- [CVE-2026-76148](https://cve.now/CVE-2026-76148.md): CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product. (CVSS 7.8, SASAKI Nobuyuki CorvusSKK)
- [CVE-2026-73335](https://cve.now/CVE-2026-73335.md): Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme (CWE-939). (CVSS 5.3, Digital Agency Android App "Myna Point")
- [CVE-2026-58092](https://cve.now/CVE-2026-58092.md): Unauthorized credential switching (CVSS 8.1, FreeBSD)
- [CVE-2026-58091](https://cve.now/CVE-2026-58091.md): Kernel use-after-free via the SNDCTL\_DSP\_SYNCSTART ioctl (CVSS 7.8, FreeBSD)
- [CVE-2026-58090](https://cve.now/CVE-2026-58090.md): Use-after-free in unix SOCK\_STREAM message handling (CVSS 7.8, FreeBSD)
- [CVE-2026-58089](https://cve.now/CVE-2026-58089.md): hwpmc fails to detach PMCs during exec credential transitions (CVSS 7.8, FreeBSD)
- [CVE-2026-54467](https://cve.now/CVE-2026-54467.md): On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, (CVSS 7.0, TrustedFirmware Trusted Firmware-M)
- [CVE-2026-19632](https://cve.now/CVE-2026-19632.md): TranslatePress – Multilingual \<= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure (CVSS 9.8, cozmoslabs TranslatePress – Translate Multilingual sites wi…)
- [CVE-2026-29988](https://cve.now/CVE-2026-29988.md): A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affecte (CVSS 8.3, Milesight AM102/102L · Milesight AM103/103L +62)
- [CVE-2026-80214](https://cve.now/CVE-2026-80214.md): LibreNMS Virtualisation Discovery Module RCE (CVSS 8.6, librenms)
- [CVE-2026-9805](https://cve.now/CVE-2026-9805.md): FMTSWriteUseIntelLib: FMTS SMM IHISI Buffer Overflow (CVSS 2.7, Insyde Software InsydeH2O)
- [CVE-2020-15874](https://cve.now/CVE-2020-15874.md): An issue was discovered in LibreNMS 1.65. (CVSS 8.8)
- [CVE-2020-15876](https://cve.now/CVE-2020-15876.md): An issue was discovered in LibreNMS 1.65. (CVSS 8.8)
- [CVE-2020-15878](https://cve.now/CVE-2020-15878.md): An issue was discovered in LibreNMS 1.65. (CVSS 8.8)
- [CVE-2023-42179](https://cve.now/CVE-2023-42179.md): Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect Access Control via the Key derivation process, password validation proc (CVSS 9.8)
- [CVE-2025-29419](https://cve.now/CVE-2025-29419.md): CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack. (CVSS 7.1)
- [CVE-2025-51675](https://cve.now/CVE-2025-51675.md): An issue was discovered in openRISC OR1200 commit 83ac6b. (CVSS 7.5)
- [CVE-2025-51679](https://cve.now/CVE-2025-51679.md): An issue was discovered in openRISC OR1200 commit 83ac6b. (CVSS 9.1)
- [CVE-2025-56798](https://cve.now/CVE-2025-56798.md): Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to (CVSS 8.8)
- [CVE-2025-61162](https://cve.now/CVE-2025-61162.md): Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/int (CVSS 7.5)
- [CVE-2025-61163](https://cve.now/CVE-2025-61163.md): Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. (CVSS 9.8)
- [CVE-2025-61164](https://cve.now/CVE-2025-61164.md): Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint. (CVSS 7.5)
- [CVE-2025-61165](https://cve.now/CVE-2025-61165.md): An arbitrary file upload vulnerability in the /v1/my\_drive/batch\_upload component of cohere North AI v1.1.5 allows attackers to exeute arbit (CVSS 9.8)
- [CVE-2025-61478](https://cve.now/CVE-2025-61478.md): An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of (CVSS 7.5)
- [CVE-2025-61479](https://cve.now/CVE-2025-61479.md): An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of (CVSS 7.5)
- [CVE-2025-61480](https://cve.now/CVE-2025-61480.md): An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of (CVSS 7.5)
- [CVE-2025-70290](https://cve.now/CVE-2025-70290.md): An issue was discovered in Denx U-Boot before 2026.04. (CVSS 9.8)
- [CVE-2025-70293](https://cve.now/CVE-2025-70293.md): An issue was discovered in Denx U-Boot before 2026.04. (CVSS 9.8)
- [CVE-2025-70340](https://cve.now/CVE-2025-70340.md): A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionali (CVSS 6.5)
- [CVE-2026-26445](https://cve.now/CVE-2026-26445.md): stomper 5e2741e is vulnerable to Denial of Service. (CVSS 7.5)
- [CVE-2026-26446](https://cve.now/CVE-2026-26446.md): Stomper 5e2741e is vulnerable to Denial of Service. (CVSS 7.5)
- [CVE-2026-26447](https://cve.now/CVE-2026-26447.md): Stomper 5e2741e is vulnerable to Use-After-Free. (CVSS 7.5)
- [CVE-2026-26448](https://cve.now/CVE-2026-26448.md): Stomper 5e2741e is vulnerable to Use-After-Free. (CVSS 9.8)
- [CVE-2026-26449](https://cve.now/CVE-2026-26449.md): In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (or (CVSS 7.5)
- [CVE-2026-36851](https://cve.now/CVE-2026-36851.md): Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration. (CVSS 7.5)
- [CVE-2026-39275](https://cve.now/CVE-2026-39275.md): Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, f (CVSS 6.1)
- [CVE-2026-51106](https://cve.now/CVE-2026-51106.md): An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component (CVSS 9.3)
- [CVE-2026-52103](https://cve.now/CVE-2026-52103.md): A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attacke (CVSS 9.8)
- [CVE-2026-52473](https://cve.now/CVE-2026-52473.md): An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessB (CVSS 4.3)
- [CVE-2026-68000](https://cve.now/CVE-2026-68000.md): The front-end interface /cms/category/list of MCMS \<=6.2.0 is vulnerable to SQL injection. (CVSS 9.8)
- [CVE-2026-75325](https://cve.now/CVE-2026-75325.md): DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/\*\*' parameters. (CVSS 9.8)
- [CVE-2026-75327](https://cve.now/CVE-2026-75327.md): In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload v (CVSS 9.8)
- [CVE-2026-75328](https://cve.now/CVE-2026-75328.md): In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnera (CVSS 7.5)
- [CVE-2026-75329](https://cve.now/CVE-2026-75329.md): The Netty configuration distribution service (port 8283) of super-diamond-server \<= 1.3.3 has no authentication mechanism. (CVSS 9.8)
- [CVE-2026-75330](https://cve.now/CVE-2026-75330.md): The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server \<= 1.3.3 is vulnerable to SQL injection. (CVSS 9.8)
- [CVE-2026-75331](https://cve.now/CVE-2026-75331.md): tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. (CVSS 4.6)
- [CVE-2026-75332](https://cve.now/CVE-2026-75332.md): Zyplayer-Doc \<=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download(). (CVSS 9.1)
- [CVE-2026-75333](https://cve.now/CVE-2026-75333.md): yx-image-recognition v1.0 is vulnerable to Path Traversal. (CVSS 7.5)
- [CVE-2026-75334](https://cve.now/CVE-2026-75334.md): The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. (CVSS 9.8)
- [CVE-2026-75336](https://cve.now/CVE-2026-75336.md): Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json. (CVSS 9.8)
- [CVE-2026-75338](https://cve.now/CVE-2026-75338.md): disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2026-75340](https://cve.now/CVE-2026-75340.md): The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Serve (CVSS 9.1)
- [CVE-2026-75363](https://cve.now/CVE-2026-75363.md): An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, (CVSS 6.8)
- [CVE-2026-75364](https://cve.now/CVE-2026-75364.md): Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update\_interface\_png SET handler in /usr/bin/webmgnt fails to saniti (CVSS 6.8)
- [CVE-2026-75411](https://cve.now/CVE-2026-75411.md): JeecgBoot v3.9.2 is vulnerable to Remote command execution. (CVSS 9.8)
- [CVE-2026-75413](https://cve.now/CVE-2026-75413.md): DocSys V2.02.80 is vulnerable to Any File Download. (CVSS 7.5)
- [CVE-2026-75414](https://cve.now/CVE-2026-75414.md): In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command ex (CVSS 9.8)
- [CVE-2026-75415](https://cve.now/CVE-2026-75415.md): AntFlow V2.0.0 is vulnerable to Incorrect Access Control. (CVSS 7.5)
- [CVE-2026-75466](https://cve.now/CVE-2026-75466.md): libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-08-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.